Polynomial Factorization Algorithms over Number Fields
Xavier-Fran¸cois Roblot [email protected]
Institut Girard Desargues, Universit´e Claude Bernard, Lyon, FRANCE This research was conducted while the author was a member
of the Laboratoire A2X, Universit´e Bordeaux I, FRANCE (Received 14 June 2002)
The aim of this paper is to describe two new factorization algorithms for polynomials.
The first factorizes polynomials modulo the prime ideal of a number field. The second factorizes polynomials over a number field.
1. Introduction
Factorization algorithms over Q[X] and Fp[X] are key tools of computational number theory. Many algorithms over number fields rely on the possibility of factoring polynomi- als in those fields. Because of the recent development of relative methods in computational number theory, see for example (Cohen et al. 1998, Daberkow and Pohst 1995), efficient generalizations of factorization algorithms to the relative case are necessary. The aim of this paper is to describe two new such algorithms.
The first algorithm factors polynomials modulo a prime ideal of a number field. It generalizes the algorithm of Berlekamp over Fp. The second factors polynomials over a number field. Note that there already exist algorithms performing this task, see (Trager 1976, Weinberger and Rothschild 1976, Lenstra 1982, Geddes et al. 1992). In fact, the method described in this paper can be viewed as a combination of the methods of Lenstra (1982) and Weinberger and Rothschild (1976).
Notations and definitions are given in the first section. The second section is devoted to the factorization modulo a prime ideal, and the third to the description of the fac- torization algorithm over a number field. In the last section we give an example, several applications and some comparison timings.
2. Notations and definitions
Let K be a number field. Let dK and OK denote respectively its discriminant and its ring of integers. Let (r1, r2) be the signature of K and N its absolute degree, so N = r1+ 2r2.
Let σ1, ..., σN be the embeddings of K into C with the usual convention: σ1, ..., σr1 are
0747–7171/90/000000 + 00 $03.00/0 2002 Academic Press Limitedc
real, and σr1+1, ..., σN are complex with σr1+i = σr1+r2+i for 1 ≤ i ≤ r2. The field K can be embedded in RN in the following way. An element θ ∈ K is sent to the vector whose first r1components are σi(θ) for 1≤ i ≤ r1, and last 2r2components are the pairs (<σj(θ) +=σj(θ),<σj(θ)− =σj(θ)) for 1 ≤ j ≤ r2. This embedding maps the ring of integers (or any fractional ideal of K) to a lattice in RN, i.e., a free additive subgroup of RN of maximal rank. From now on, we identify K with its image in RN. Thus, the square of the Euclidean distance on RN yields a quadratic form on K, the so-called T2-norm, defined by
T2(θ) :=
N
X
i=1
|σi(θ)|2.
Let n≥ 1 be an integer and let L be a lattice in Rn, see (Conway and Sloane 1988).
Denote byB = {b1, ..., bn} a basis of the lattice L. The fundamental domain of B is DB:=
(x1b1, ..., xnbn) where −1
2 < xi≤1
2 for all i
.
The origin is the only point of L contained in this domain and every point x∈ Rncan be uniquely written as x = y + l where l ∈ L and y ∈ DB. The volume of the lattice V (L) is defined to be the volume of the fundamental domain. It does not depend on the choice of the basis. The defect of orthogonality of the basisB is defined by
δB:=
n
Q
i=1
|bi| V (L),
where|.| denotes the length. This defect is ≥ 1 by Hadamard’s inequality, and in fact it is equal to 1 if and only if the basis is orthogonal. For an LLL-reduced basisB of L, as defined in (Lenstra et al. 1982), one gets
δB≤ 2n(n−1)/4.
Finally, for a vector x∈ Rn, we denote by bxe the vector of Zn that one obtains by rounding each component of x to the nearest integer (with the convention that m + 12 rounds to m + 1 for m∈ Z).
3. Factorization of polynomials modulo a prime ideal
Let p be a prime ideal of K dividing the rational prime p. Let Fp denote the residual field
Fp:= OK
p .
This field is isomorphic to the finite field Fq where q :=N p is the absolute norm of p.
Let S(X) be a polynomial with coefficients in Fp. The following method factors S using a generalization of the method of Berlekamp (1970) as described in (Cohen 1993, section 3.4). Another method to factorize polynomials over finite fields can be found in (Cantor and Zassenhaus 1981).
The first step is to compute a polynomial S0(X) that is monic, square-free, and divisible exactly by the same irreducible factors as S(X). We include the algorithm to do so for the sake of completeness and refer the reader to (Cohen 1993, section 3.4.2) for the proof of its validity.
Algorithm 3.1. Squarefree factorization of a polynomial S(X)∈ Fp[X].
1. Set T0← S and S0← 1.
2. If T0 is constant, output S0 and terminate the algorithm.
3. Set T ← GCD(T0, T00), V ← T0/T and k← 0.
4. If V is constant, it is of the form
T (X) =X
p|j
tjXj,
then set T0←P
p|jtjXj/p and go to step 2.
5. Set k← k + 1. If p divides k then set T ← T /V and k ← k + 1.
6. Set W ← GCD(T, V ), A ← V /W , V ← W and T ← T /V . If A is not constant then set S0← S0A. Go to step 4.
We now assume without loss of generality that S is a monic square-free polynomial.
Let m denote its degree. The key result is the following theorem of Berlekamp (1970).
Theorem 3.2. Let
S(X) =
g
Y
i=1
Si(X)
be the irreducible factorization of S. Then, for any A(X) ∈ Fp[X] of degree < m, the following assertions are equivalent:
(i) There exist elements αi∈ Fp such that A(X)≡ αi (mod Si) for all i.
(ii) The polynomial A satisfies A(X)q≡ A(X) (mod S).
(Recall that q is the absolute norm of p).
Using the Chinese Remainder Theorem, one easily proves that there exists for each g- tuple (αi)i∈ Fpg
a unique polynomial A(X) satisfying assertion (i). Hence the solutions of theorem 3.2 span an Fp-vector space of dimension g.
Now, let A(X) :=
m−1
P
i=0
aiXisatisfy the conditions of the theorem. Then the coefficients of A satisfy
ai=
m−1
X
j=0
ajri,j, where the ri,j’s are defined by
Xjq =
m−1
X
i=0
ri,jXi (mod S).
Thus the computation of a basis of the solutions of theorem 3.2 boils down to the kernel computation of the matrix R− Imwhere R is the matrix with entries ri,j, and Im is the identity matrix of dimension m. Note that the number of irreducible factors of S is exactly the rank of this kernel. Therefore, if this rank is 1, the polynomial S is irreducible and the factorization is done. Hence, we suppose from now on that the polynomial S is reducible and we let g denote the number of irreducible factors of S, so g≥ 2.
Assume that we can find a solution A(X) such that α16= α2(with the notation of the theorem 3.2). Then S1(X) divides A(X)−α1but S2(X) does not. Therefore, the GCD of A(X)−α1and S(X) yields a non-trivial factor of S. And we may repeat this process until S(X) is broken into g factors which are then known to be irreducible. Unfortunately, the drawback of the above method is that we need to find such a polynomial A(X) and the corresponding element α1. And this is definitely a hard task when the field Fp is large.
We use instead the following method.
Proposition 3.3. Let (Ai)i be a basis of the solutions of theorem 3.2, and let A(X) :=
P
ibiAi(X) be a random linear combination of the Ai’s. If p = 2, set D(X) := A(X) + A(X)2+ A(X)4+ ... + A(X)q/2; otherwise set
D(X) := A(X)(q−1)/2− 1.
Then the GCD of S(X) and D(X) yields a non-trivial factorization of S with a probability of a least 4/9.
Proof. For each i, let αi be the element of Fp such that Si divides A(X)− αi. First, suppose that p = 2 and set B(X) := X + X2+ X4+ ... + Xq/2. Then B(X)(B(X) + 1) = Xq+ X and the field Fpis the disjoint union of the set of the q/2 roots of B(X) and the set of the q/2 roots of B(X) + 1. Denote byR the set of roots of B(X). Then
D(X) = Y
ρ∈R
(A(X)− ρ).
Thus the GCD of S(X) and D(X) is equal to a constant if and only if none of the αi’s are inR. This event has a probability of 1/2g. On the other hand, the GCD of S(X) and D(X) is equal to S(X) if and only if all the αi’s belong toR. And, this event has also a probability of 1/2g. Hence, this GCD is non-trivial with a probability of 1−1/2g−1≥ 1/2.
The case where p is an odd prime is similar, withR being the set of square elements of F×p. Then the GCD of S(X) and D(X) is non-trivial with a probability of 1−
q−1 2q
g
−
q+1
2q
g
≥ 4/9.
2
Putting all these results together, we obtain the following probabilistic algorithm.
Algorithm 3.4. Factorization of a polynomial S(X)∈ Fp[X].
1. Using algorithm 3.1, compute a monic square-free polynomial S0 with the same irreducible factors as S.
2. Compute the coefficients ri,j such that Xjq = P
iri,jXi (mod S0) and set R ← (ri,j)i,j.
3. Compute the kernel of the matrix R−Imand denote its rank by g. If g > 1, compute also a basis A1(X), ..., Ag(X) of the solutions of theorem 3.2.
SetF ← {S0(X)} and k ← 1.
4. If k = g then go to step 6.
Let b1, ..., bg be random elements of Fp. Set A(X)←
g
X
i=1
biAi(X).
Set also
D(X)← A(X) + A(X)2+ ... + A(X)q/2 if q is even, or
D(X)← A(X)(q−1)/2− 1 otherwise. SetG ← ∅.
5. Pick up a polynomial B(X) ∈ F and set F ← F \ {B(X)}. Compute C(X) ← GCD(B(X), D(X)). If 0 < deg C < deg B, then setG ← G ∪ {C(X), B(X)/C(X)}, and set k← k + 1. Otherwise, set G ← G ∪ {B(X)}. Finally, if F 6= ∅ then go to step 5; otherwise setF ← G and go back to step 4.
6. For each polynomial Si(X)∈ F, compute the greatest positive integer ei such that Si(X)ei divides S(X). Output the factorization
S(X) = s
g
Y
i=1
Si(X)ei
where s is the leading coefficient of S, and terminate the algorithm.
4. Factorization of polynomials over a number field
We first recall how one factorizes polynomials over Q as explained in (Cohen 1993, section 3.5). Let S(X) be a polynomial with rational coefficients. Without loss of gener- ality, we can assume that S is a square-free polynomial with coefficients in Z. To simplify the description of the method, we also assume that S is monic. In order to factor S, one first factors it modulo a “well-chosen” rational prime number p. Then, using a re- sult of Mignotte (1974), one computes an explicit bound C on the absolute value of the coefficients of any non-trivial divisor of S(X). Finally, one uses Hensel lemma to lift this factorization modulo pe where pe > 2C. Then every factor of S in Q[X] is the lift of a divisor of S modulo pe where the lift is chosen with coefficients in the interval ]− pe/2, pe/2]. Therefore, one recovers all the factors of S in Q[X] from the factors of S modulo pe(and in particular all the irreducible factors).
Similarly, the steps for the relative algorithm are the following. Given a polynomial S(X) with coefficients in a number field K, we first find a square-free polynomial with the same irreducible factors and with integral coefficients. We factor this polynomial modulo a “well-chosen” prime ideal p of K. Then, using a generalization of Mignotte’s bounds, we compute a bound for the T2-norm of the coefficients of any non-trivial factor of S(X), and lift this factorization using Hensel lemma. Eventually, we recover the irreducible factors in K[X] from this lifted factorization. Note that this final step is not as straightforward as in the absolute case.
Let S(X) be a polynomial with coefficients in K. If S is not square-free, we may also replace S by S/GCD(S, S0), that is, a square-free polynomial with exactly the same irreducible factors.
We now assume without loss of generality that S is a square-free polynomial, and multiplying if necessary this polynomial by some well-chosen element in K×, we can also assume that it has coefficients inOK, and that its leading coefficient is a rational integer s. However, we cannot talk of factorization in this ring sinceOK may not be principal.
Let p be a prime ideal of K such that p does divide neither the discriminant of S nor
its leading coefficient s. The reduction of S modulo p is a square-free polynomial of the same degree. We use the result of the last section to obtain the factorization
S(X)≡ s
g
Y
i=1
Si(X) (mod p).
If g = 1 then the polynomial S is irreducible modulo p, therefore it is also irreducible in K[X] and the factorization is done. From now on, assume that S is reducible, so g≥ 2.
We need to lift this factorization modulo pe where the value of the exponent e will be discussed below. As we said before, we use Hensel lifting which is a classic result that can be found in any textbook about algebraic number theory. We refer to (Cohen 1993) for an algorithmic version. We only quote here the result. Note that this theorem is proved in a more general case in (Pohst and Zassenhaus 1989).
Theorem 4.1. Let S be a square-free polynomial in OK[X], and let p be a prime ideal of K such that p does divide neither the discriminant of S nor its leading term. Let
S(X)≡ s
g
Y
i=1
Si(X) (mod p)
denote the irreducible factorization of S in Fp[X]. Then, for every integer e≥ 1, there exist polynomials Si,e(X)∈ OK[X] such that
S(X)≡ s
g
Y
i=1
Si,e(X) (mod pe)
and Si,e(X)≡ Si(X) (mod p). Furthermore, these polynomials are unique modulo pe. In order to find a suitable value for the exponent e, we need to know more about the size of the T2-norm of the coefficients of a divisor of S. This theorem is a generalization of a result of Mignotte (1974).
Theorem 4.2. Let S(X) =
m
P
i=0
siXi with leading coefficient s = sm ∈ Z \ {0}. Define T2(S) :=
m
P
i=0
T2(si). Then, for every monic divisor D(X) := Xl+
l−1
P
j=0
djXj of S(X) in K[X], we have
T2(dj)≤ T2(S)l − 1 j
+ l − 1 j− 1
2
for 0≤ j ≤ n − 1.
Proof. For each embedding σ of K into C, the monic polynomial σ(D) divides the polynomial σ(S) in C[X] and its leading term is smaller (in absolute value) than the leading term of S. Thus, by Mignotte’s bounds, it follows that
|σ(dj)| ≤l − 1 j
|σ(S)| + l − 1 j− 1
|s|
where |σ(S)| := Pm
i=0|σ(si)|21/2
. Now, using the fact that|s| ≤ |σ(S)|, squaring this expression, and summing over all the embeddings of K gives the result.
2
Denote by C an upper bound for the T2-norm of every coefficient of such a non-trivial divisor of S. We use this bound by means of the following two results.
Proposition 4.3. Let π be a non-zero element of pewhere e≥ 1. Then T2(π)≥ N q2e/N.
Proof. The inequality between arithmetic mean and geometric mean gives 1
N
N
X
i=1
|σi(π)|2≥
N
Y
i=1
|σi(π)|2
!1/N
or equivalently T2(π)≥ N|NK/Q(π)|2/N. Since π is a non-zero element of pe, its norm is divisible by qe and the result follows.
2
Corollary 4.4. Let e be an positive integer such that e≥ N
2
log(4s2C/N ) log q
and denote by eD(X) any monic divisor of S(X) modulo pe. Then there exists at most one polynomial D(X)∈ OK[X] with leading coefficient s, and such that D(X)≡ s eD(X) (mod pe) and D divides S in K[X].
Proof. Let eδ be any coefficient of eD(X) and let δ be the corresponding coefficient of D(X). Then δ ≡ s eδ (mod pe), and T2(δ) < s2C since s−1D satisfies the condition of proposition 4.2. To prove the corollary, it is enough to prove that there exists at most one algebraic integer inOK satisfying these two conditions. Now, suppose that δ0 is another algebraic integer which satisfies these conditions. Set π := δ− δ0. Then, π ∈ pe and T2(π) < 4s2C≤ Nq2e/N, thus π = 0 by the proposition. Therefore δ = δ0 and the result is proved.
2
Let e be an integer satisfying the hypothesis of the corollary. We need to be able to compute, if it exists, the polynomial D corresponding to a divisor eD of S modulo pe. In order to do so, we need to work with a larger exponent e. We use the following procedure given in (Lenstra 1982).
Proposition 4.5. LetB be a basis of a lattice L in RN. Then, the fundamental domain ofB contains a ball centered on the origin of radius
RB> mB 2δB where mB is the minimum length of the elements of B.
In particular, ifB is an LLL-reduced basis of pe, then every element θ∈ OK that does not belong to the fundamental domain of B satisfies
T2(θ) > N 4
q2e/N 4N (N−1)/4.
Let e be an integer such that
e > N 2
log(s2C/N ) +N (N
−1) 4 + 1
log 4
log q . (†)
LetB denote an LLL-reduced basis (for the T2-norm) of pe. Let eD be a monic divisor of S modulo pe. With the notations of 4.4, we want to compute (if it exists) the polynomial D(X) congruent to s eD(X) modulo pedividing S. Assume D exists, let eδ be a lift inOK
of any coefficient of eD, and let δ be the corresponding coefficient of D. Then δ is the only algebraic integer congruent to s eδ contained in the fundamental domain ofB. Indeed, any other algebraic integer δ0 congruent to s eδ modulo peis outside the fundamental domain, and so must satisfies T2(δ0) > s2C by proposition 4.5 and inequality (†). Thus, we have δ = s eδ− λ where λ is the point of the lattice that is the closest to s eδ. This point can be computed in the following way. Fix an integral basis Ω :={ω1, ..., ωN} of K, and let M be the matrix expressing the Z-basisB with respect to Ω. Let ed := ( ed1, ..., edN)∈ ZN be such that s eδ =P
ideiωi. Then λ =P
iliωi where l = (l1, ..., lN) is given by l = Mj
M−1dem . We are now ready to give the complete algorithm.
Algorithm 4.6. Factorization of a polynomial S(X)∈ K[X].
1. Set S0 ← S/GCD(S, S0), and U ← d S0 where d is a non-zero element of K such that d S0(X)∈ OK[X] and the leading term u of U is a rational integer. Let p be a prime ideal of K that does divide neither the discriminant of U nor its leading term u. Note that prime ideals can be computed using algorithm 6.2.9 of Cohen (1993).
2. Let e be an integer satisfying (†). Compute the factorization U (X)≡ u
g
Y
i=1
Ui(X) (mod p)
by algorithm 3.4. If g > 1 then lift this factorization modulo pe using Hensel’s lemma, and let eUi denote the factors obtained. Otherwise, i.e. if g = 1, set F ← {u−1U}, and go to step 6.
3. Compute an LLL-reduced basisB of the ideal pe. Set r← 1, E ← { eU1, ..., eUg} and F ← ∅.
4. For every product eD(X) := E1(X)...Er(X) of r (distinct) elements of E, compute the polynomial D congruent to u eD modulo pe using the method explained above.
If D(X) divides U (X), then remove from E the factors Ei, set F ← F ∪ { ˆD} where ˆD is the monic polynomial obtained by dividing D by its leading term and set U← d (U/D) where d is a non-zero element of K such that d (U/D) ∈ OK[X]
and its leading term u is a rational integer.
In any case, if there exist products of r (remaining) elements ofE that has not been tested, redo this step.
5. Set r ← r + 1. If r ≤ (deg U)/2 then go back to step 4. If deg U ≥ 1, then set F ← F ∪ {u−1U}.
6. For every Si ∈ F, compute the greatest integer ei such that Si(X)ei divides S(X).
Output the factorization
S(X) = s
h
Y
i=1
Si(X)ei with s the leading term of S, and terminate the algorithm.
Remark 4.1. If one is only interested in the factorization in K[X], but not in the factorization in Fp[X], then one can choose a prime ideal p of degree 1. Then the residue field Fp is isomorphic to Fp, with pZ = p∩ Z, and one can use a standard factorization algorithm in Fp[X]. Furthermore, if p is also unramified, one can also avoid the use of Hensel’s lemma by computing directly the p-adic factorization in the complete field Kp
(isomorphic to Qp) with the precision pe. Algorithms to compute factorization in Qp are given in (B¨offgen 1987, B¨offgen and Reichert 1987, Ford et al. 2002).
Remark 4.2. Several improvements to this algorithm are possible including a relative version of van Hoeij (2002), see (Belabas et al. 2002), and the use of the method described in (Fieker and Friedrichs 2000) to replace the use of an real LLL algorithm by an (usually faster and, in anyway, stabler) integral one.
5. Implementation and Applications
The two preceding algorithms have been programmed in the number theory package PARI (Batut et al. 2002). Polynomial factorization algorithms over number fields are also implemented in other number theory packages e.g., KANT (Pohst et al. 2002), SIMATH (Zimmer et al. 1998) using the method described in (Pohst and Zassenhaus 1989), or more general purpose packages such as MAGMA (Cannon et al. 2002).
5.1. An Example
Let K := Q(α) where α is a root of X3− X2− 9X + 8. We want to factorize in this field the polynomial
S(X) = X3+ (6α− 9)X + (5α2− 33α + 13)X − 5α + 30.
With the notations of theorem 4.2, we have T2(S) = 29 362, and thus C = 88 089 is an upper bound for the T2-norm of the coefficients of any non-trivial monic divisor of S in K[X]. The prime ideal p is chosen to be the only prime ideal above 5 of residual degree 2. Using algorithm 3.4, one finds
S(X)≡ X(X + 2)(X + α + 4) (mod p).
Inequality (†) tells us that the exponent e has to be greater than 6. By Hensel’s lemma, we lift the factorization modulo p7 and obtain the following factors
De1(X) = X + 390100α + 24260, De2(X) = X + 530α + 366362, De3(X) = X + α + 390619.
We compute an LLL-reduced basisB for the T2-norm of p7. The matrix of this basis over the integral basis{1, α, α2} is
M =
−4055 1854 4789
−5 1139 −1651 140 −642 −647
.
With the notations of corollary 4.4, we compute the polynomial D1(X) = X− 2271 − 579α + 338α2, and its constant term has a T2-norm of 10 687 724 which is larger than C.
Thus D1(X) cannot be a divisor of S. For the same reason, we find that the polynomial D2 cannot divides S. However, the last polynomial is D3(X) = X + α− 6 and it does divide S(X). We obtain
S(X) = (X + α− 6)(X2+ (−3 + 5α)X − 5).
Finally, we know that this second factor is irreducible since, otherwise, its factorization will be given by the lift of eD1and eD2. Therefore, this is the complete factorization of S in K[X].
The defect of orthogonality of the LLL-reduced basisB given by M is δB' 1.094 and the value of mB is approximately 5 573.6. Thus, the fundamental domain of this basis contains a ball centered on the origin of radius RB ≥ 2 546 and every algebraic integer of K which is not contained in this domain has a T2-norm greater than 6 486 381.
5.2. Applications of the polynomial factorization over a number field We use the following notations: K := Q(α) and L := Q(β) are two number fields where α (resp. β) is the root of the irreducible integral polynomials A(X) (resp. B(X)).
5.2.1. Subfield test
The field K is conjugate to a subfield of L if and only if the polynomial A has a linear factor in L[X]. If it is so, this factor gives also an expression of α (up to isomorphism) as a polynomial in β. Now, if α and β are known as complex numbers, one can test if K ⊂ L (not only up to isomorphism) by computing a precise enough value of the root of this linear factor.
5.2.2. Relative minimal polynomial
If K is known to be conjugate to a subfield of L, then the irreducible factors of B(X) in K[X] are the minimal polynomials over K of the conjugates of β by the Q-isomorphisms of K. Once again, it is possible to find exactly which is the minimal polynomial of β over K by using complex approximations.
5.2.3. Field automorphisms
Every linear factor in the factorization of B(X) in L[X] yields a Q-automorphism of L, and this automorphism is explicitly expressed as a polynomial in β (note that one always obtains the trivial factor X− β corresponding to the identity automorphism). Similarly, if one factors in L[X] the relative minimal polynomial BK(X) of β over a subfield K, then one obtains explicitly all the K-automorphisms of L.
5.2.4. Galois closure and Galois group
Assume that the polynomial B splits totally over L[X]. Then L/Q is a Galois extension.
In a similar way, if the factorization of BKin L[X] has only linear factors, then L/K is a Galois extension. Conversely, if the polynomial B (resp. BK) does not split completely, then the extension is not Galois, and any root θ of a non-linear factor of B (resp. BK) yields an new extension L(θ)/Q (resp. L(θ)/K) that is contained in the Galois closure of L/Q (resp. L/K). By factoring B (resp. BK) in this new field, one can test if this field is indeed the Galois closure. If not, one has to consider the field generated over L(θ) by a root of any non-linear factor. Using this method, one obtains finally the Galois closure of L, and may even be able to recover its Galois group by a close look at the factors encountered, especially when this group is solvable, see (Landau and Miller 1985).
5.2.5. n-th roots of an algebraic number
Let θ be an algebraic number in K, and let n≥ 2 be an integer. Then, one obtains all the n-th roots of θ in K by factoring the polynomial Xn− θ in K[X]. In particular, when θ = 1, one can use this method, or a refined version as described in the algorithm 4.9.10 of Cohen (1993), to compute all the roots of unity contained in K.
5.3. Applications of polynomial factorization modulo a prime ideal We keep the same notations. We assume also from now on that K is a subfield of L.
5.3.1. Relative Dedekind Criterion
Let p be a prime ideal of K, and let θ be an algebraic integer of L such that L = K(θ).
This criterion tells us if the orderOK[θ] is p-maximal (recall that this order is said to be p-maximal, if p does not divide the index (OL :OK[θ])). Furthermore, if it this order is not p-maximal, then the criterion defines a new orderO0, strictly larger thanOK[θ]. We quote the result without proof, and refer to (Roblot 1997) for the proof. We also refer the reader to theorem 6.1.4 of Cohen (1993) for the absolute version of the criterion. We denote by T (X) the minimal polynomial of θ over K.
Theorem 5.1. Let τ be an element of K such that vp(τ ) =−1 and vq(τ )≥ 0 for any prime ideal q6= p. For any P (X) ∈ OK[X], let P denote its reduction modulo p. Let
T (X) =
r
Y
i=1
Ti(X)ei
be the irreducible factorization of T in Fp[X]. Let g(X) :=Q
iTi(X), and let h(X) be any lift of T /g of the same degree. We define
f (X) := τ (g(X)h(X)− T (X)) ∈ OK[X].
(i) The order OK[θ] is p-maximal if and only if GCD(f , g, h) = 1.
(ii) Let U (X) be any lift of T /GCD(f , g, h) of the same degree. Define the following module
O := Oe K[θ] + U (θ)p−1OK[θ].
Then, eO is an order of L containing OK[θ], and (O : OK[θ]) = pm where m is the degree of GCD(f , g, h).
5.3.2. Decomposition of prime ideals
As above, let θ be an algebraic integer such that L = K(θ), and let T (X) denote its minimal polynomial over K. Let p be a prime ideal of K. If p does not divide the index (OL : OK[θ]), then the decomposition of p in L is given by the factorization of T (X) modulo p. More precisely, one has the following theorem which is proved in (Pohst and Zassenhaus 1989).
Theorem 5.2. Let
T (X)≡
r
Y
i=1
Ti(X)ei (mod p)
be the irreducible factorization of T in Fp[X], where the polynomials Ti(X) are monic and belong toOK[X]. Then, there exist exactly r prime ideals Pidividing pOL, and these prime ideals are given by
Pi:= pOL+ Ti(θ)OL.
Furthermore, the ramification index (resp. the residual degree) of Pi over p is ei (resp.
the degree of the polynomial Ti).
5.3.3. The relative Round 4 algorithm
The absolute Round 4 algorithm is used to compute the maximal order of a p-adic fields. It is also used to compute the ring of integers of a number field as a Z-module. It is described in (Ford 1978, Ford 1987, Ford and Letard 1994, B¨offgen 1987, B¨offgen and Reichert 1987, Ford et al. 2002). Since this algorithm deals only with p-adic computations, one can generalize this algorithm to the relative case using p-adic computations. However, this is a difficult and complicated algorithm, thus we will not give any details here and the interested reader can refer to (Roblot 1997).
5.4. Comparison timings
We have compared the implementation in PARI (v. 2.2.4) of the algorithm described in section 4 to the algorithm available in KASH (v. 2.2) (Pohst et al. 2002) which uses a norm-based factorization. We have considered random polynomials over random number fields of various degrees. These were constructed in the following way.
We take the polynomials defining the number fields as random monic irreducible poly- nomials with integral coefficients in the interval [−5; 5]. For T such a polynomial of degree n, let K be the number field defined by one of its roots,OK be the ring of integers of K and{ω1= 1, . . . , ωn} be an integral basis of OK.
Now, we choose a random integer t in [2, 6], and produce t random polynomials in OK[X] of degree between 1 and 7 with coefficients
λ1ω1+· · · λnωn∈ OK
where the λi’s are random integers in the interval ]− 500; 500[. Multiplying these t polynomials together gives us the polynomial we want to factorize.
For 2≤ n ≤ 7, we have constructed in this way 10 random polynomials over 15 random number fields of degree n, and factorized these polynomials using the two packages. The corresponding timings are given in the following table. Note that the computation time of the new algorithm is largely dominated by the LLL-reduction step when the degree of the number field is large.
The computation were performed on a Pentium III with 1000MHz and 1GB of RAM running Linux 2.4.3.
n KANT PARI n KANT PARI
2 7.1s 2.7s 5 80s 38s
3 20s 6.5s 6 136s 63s
4 39s 13s 7 279s 206s
References
Batut, C., Belabas, K., Bernardi, D., Cohen, H., Olivier, M. (2002). Number theory package PARI, v.2.2.4 (development). http://www.parigp-home.de/.
Belabas, K., Hanrot, G., Zimmermann, P. (2002) A relative version of van Hoeij algorithm, work in progress with a pilot implementation in PARI/GP.
Berlekamp, E. (1970). Factoring polynomials over large finite fields. Math. Comp. 24, 713–735.
B¨offgen, R. (1987). Der Algorithmus von Ford/Zassenhaus zur Berechnung von Ganzheitsbasen in Polynomalgebren. Ann. Univ. Saraviensis, Ser. Math. 1, 60–129.
B¨offgen, R., Reichert, M. A. (1987). Computing the decomposition of primes p and p-adic absolute values in semi-simple algebras over Q. J. Symb. Comp. 4, 3–10.
Cannon, J. et al. (2002). The Magma Computational Algebra System for Algebra, Number Theory and Geometry, v.2.9. http://magma.maths.usyd.edu.au/magma/.
Cantor, D. G., Zassenhaus, H. (1981). A new algorithm for factoring polynomials over finite fields. Math.
Comp. 36, 587–592.
Cohen, H. (1993). A Course in Computational Algebraic Number Theory, volume 138 of Graduate Texts in Math. Springer-Verlag.
Cohen, H., Diaz y Diaz, F., Olivier, M. (1998). Computing ray class groups, conductors and discriminants.
Math. Comp. 67, 773–795.
Conway, J., Sloane, N. (1988). Sphere Packing, Lattices and Groups, volume 290 of Grundlehren der math. Wiss., Springer-Verlag.
Daberkow, M., Pohst, M. (1995). Computations with relative extensions of number fields with an application to the construction of Hilbert class fields. In Proc. ISAAC’95.
Fieker, C., Friedrichs, C. (2000). On reconstruction of algebraic numbers. In Algorithmic number theory ANTS-IV (Leiden), Lecture Notes in Comp. Sci. 1838, Springer, 285–296
Ford, D. (1978). On the Computation of the Maximal Order in a Dedekind Domain. PhD thesis, Ohio State University.
Ford, D. (1987). The construction of maximal orders over a Dedekind domain. J. Symb. Comp. 4, 69–75.
Ford, D., Letard, P. (1994). Implementing the Round Four maximal order algorithm. S´em. Th. Nombres de Bordeaux 6, 39–80.
Ford, D., Pauli, S., Roblot, X.-F. (2002). A fast algorithm for polynomial factorization over Qp, to appear in Journal de Th´eorie des Nombres de Bordeaux.
Geddes, K., Czapor, S., Labahn, G. (1992). Algorithms for Computer Algebra. Kluwer Academic Press.
van Hoeij, M. (2002). Factoring polynomials and the knapsack problem, to appear in Journal of Number Theory.
Landau, S., Miller, G. L. (1985). Solvability by radicals is in polynomial time. J. Comput. Syst. Sci.
30, 179–208.
Lenstra, A. K. (1982). Factoring polynomials over algebraic number fields. LN in Comp. Sci. 144, 32–39.
Lenstra, A. K., Lenstra, H. W., Lov´asz, L. (1982). Factoring polynomials with rational coefficients.
Math. Ann. 261, 515–534.
Mignotte, M. (1974). An inequality about factors of polynomials. Math. Comp. 28, 1153–1157.
Pohst, M., Zassenhaus, H. (1989). Algorithmic Algebraic Number Theory. Cambridge Univ. Press.
Pohst, M. et al. (2002). Number theory package KANT, v.2.2. http://www.math.tu-berlin.de/~kant/.
Roblot, X.-F. (1997). Algorithmes de Factorisation dans les Extensions Relatives et Applications de la Conjecture de Stark `a la Construction des Corps de Classes de Rayon. PhD thesis, Laboratoire A2X, Universit´e Bordeaux I.
Trager, B. (1976). Algebraic factoring and rational function integration. In Proc. of SYMSAC’76, 219–226.
Weinberger, P.J., Rothschild, L.P. (1976). Factoring polynomials over algebraic number fields. ACM Transactions on Math. Software 2, 335–350.
Zimmer, H. G. et al. (1998). Number theory package SIMATH. http://www.math.uni-sb.de/~simath/.
